feat(OSPS-BR-02.02): associate release assets with release identifiers

[jmeridth]

Closes #17

What/Why

Implements OSPS-BR-02.02, the remaining half of the parent issue (BR-02.01 already landed): release assets must be clearly associated with the release identifier or another unique identifier. The new ReleaseAssetsAssociatedWithRelease step checks whether each published, non-draft release's asset names embed the release identifier (tag, tag without the leading v, or an unspaced release name), exempting signature/checksum/attestation/SBOM companions and standard docs files that are associated through the artifact they accompany. Unrecognized identifiers surface as NeedsReview rather than Failed because the control permits "another unique identifier" the scanner cannot observe (the same rationale the QA-02.02 SBOM check uses). Release gating reuses reusable_steps.HasPublishedRelease, so drafts are excluded and unobservable release data degrades to NeedsReview, with explicit confidence on every return.

Proof it works

• 16-case table test asserting result, message, and confidence for every branch: unobservable data, drafts, no assets, tag/v-prefix/release-name association, case-insensitivity, companion exemptions, cross-release aggregation, message capping at five with an overflow note, a single-digit-tag overmatch guard, and companion-only releases.
• Helper tests for identifier-candidate derivation and companion classification.
• go test ./... across all packages and go test -race on the touched packages pass locally.

Risk + AI role

Low: a new single-step check plus wiring; no existing control logic modified. AI-generated end to end with maintainer-approved design; the interpretation (naming heuristic with NeedsReview, no Failed path) was an explicit maintainer decision over structural-only or fail-on-missing readings.

Review focus

• The control interpretation: is NeedsReview-not-Failed the right call for assets without a recognizable identifier, and is the companion-file exemption list appropriately scoped?
• Identifier candidate rules: v-prefix stripping with the two-character guard, and skipping spaced release names.

[jmeridth]

🤖 e922b1f rewords this PR's new doc comment to describe behavior instead of the catalog ID, per #448 category 1. The ID linkage stays in the dispatch map entry.